Initial commit

.claude-plugin/plugin.json

@@ -0,0 +1,15 @@
+{
+  "name": "cors-policy-validator",
+  "description": "Validate CORS policies",
+  "version": "1.0.0",
+  "author": {
+    "name": "Jeremy Longshore",
+    "email": "[email protected]"
+  },
+  "skills": [
+    "./skills"
+  ],
+  "commands": [
+    "./commands"
+  ]
+}

README.md

@@ -0,0 +1,3 @@
+# cors-policy-validator
+
+Validate CORS policies

commands/validate-cors.md

@@ -0,0 +1,8 @@
+---
+description: DESCRIPTION_PLACEHOLDER
+shortcut: SHORTCUT_PLACEHOLDER
+---
+
+# TITLE_PLACEHOLDER
+
+CONTENT_PLACEHOLDER

plugin.lock.json

@@ -0,0 +1,61 @@
+{
+  "$schema": "internal://schemas/plugin.lock.v1.json",
+  "pluginId": "gh:jeremylongshore/claude-code-plugins-plus:plugins/security/cors-policy-validator",
+  "normalized": {
+    "repo": null,
+    "ref": "refs/tags/v20251128.0",
+    "commit": "9d68606f12e495a1561dacc4b296850463579964",
+    "treeHash": "75a9971c17ec12c9be563b8d6b82ad73dbf98ebe1bfdda39a9561eb08b40946f",
+    "generatedAt": "2025-11-28T10:18:14.943374Z",
+    "toolVersion": "publish_plugins.py@0.2.0"
+  },
+  "origin": {
+    "remote": "git@github.com:zhongweili/42plugin-data.git",
+    "branch": "master",
+    "commit": "aa1497ed0949fd50e99e70d6324a29c5b34f9390",
+    "repoRoot": "/Users/zhongweili/projects/openmind/42plugin-data"
+  },
+  "manifest": {
+    "name": "cors-policy-validator",
+    "description": "Validate CORS policies",
+    "version": "1.0.0"
+  },
+  "content": {
+    "files": [
+      {
+        "path": "README.md",
+        "sha256": "6b9041b19214614b7029e905a1c7fb9a221fb3f45e414ad6ad94ff94e418726d"
+      },
+      {
+        "path": ".claude-plugin/plugin.json",
+        "sha256": "565b03c46a78fe200332fc76efb51f04258537cc6cc6354b00393dd6b13be8c4"
+      },
+      {
+        "path": "commands/validate-cors.md",
+        "sha256": "26981dafecd0bda9d89082c091325c9fdc3ac197318243e952dde0b1a38f4088"
+      },
+      {
+        "path": "skills/cors-policy-validator/SKILL.md",
+        "sha256": "f732d91a45bfefef8ca8f931e13bd3c87d7691737599264fd7c4c5e73ddb6300"
+      },
+      {
+        "path": "skills/cors-policy-validator/references/README.md",
+        "sha256": "2225c0ff3accad0dea8f2be8cd7442337224e360a363f17e7a3b4aaad226274f"
+      },
+      {
+        "path": "skills/cors-policy-validator/scripts/README.md",
+        "sha256": "5b3c064953d24c64d3393e2a17de2483115883dd813217d38ef6a73ebd574b56"
+      },
+      {
+        "path": "skills/cors-policy-validator/assets/README.md",
+        "sha256": "fce15b85c948918c66b8f41a4d208935ce7b681542cb3dce5472e4d371b7756d"
+      }
+    ],
+    "dirSha256": "75a9971c17ec12c9be563b8d6b82ad73dbf98ebe1bfdda39a9561eb08b40946f"
+  },
+  "security": {
+    "scannedAt": null,
+    "scannerVersion": null,
+    "flags": []
+  }
+}

skills/cors-policy-validator/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: validating-cors-policies
+description: |
+  This skill enables Claude to validate Cross-Origin Resource Sharing (CORS) policies. It uses the cors-policy-validator plugin to analyze CORS configurations and identify potential security vulnerabilities. Use this skill when the user requests to "validate CORS policy", "check CORS configuration", "analyze CORS headers", or asks about "CORS security". It helps ensure that CORS policies are correctly implemented, preventing unauthorized cross-origin requests and protecting sensitive data.
+allowed-tools: Read, WebFetch, WebSearch, Grep
+version: 1.0.0
+---
+
+## Overview
+
+This skill empowers Claude to assess the security and correctness of CORS policies. By leveraging the cors-policy-validator plugin, it identifies misconfigurations and potential vulnerabilities in CORS settings, helping developers build more secure web applications.
+
+## How It Works
+
+1. **Analyze CORS Configuration**: The skill receives the CORS configuration details, such as headers or policy files.
+2. **Validate Policy**: It utilizes the cors-policy-validator plugin to analyze the provided configuration against established security best practices.
+3. **Report Findings**: The skill presents a detailed report outlining any identified vulnerabilities or misconfigurations in the CORS policy.
+
+## When to Use This Skill
+
+This skill activates when you need to:
+- Validate a CORS policy for a web application.
+- Check the CORS configuration of an API endpoint.
+- Identify potential security vulnerabilities in existing CORS implementations.
+
+## Examples
+
+### Example 1: Validating a CORS Policy File
+
+User request: "Validate the CORS policy in `cors_policy.json`"
+
+The skill will:
+1. Read the `cors_policy.json` file.
+2. Use the cors-policy-validator plugin to analyze the CORS configuration.
+3. Output a report detailing any identified vulnerabilities or misconfigurations.
+
+### Example 2: Checking CORS Headers for an API Endpoint
+
+User request: "Check CORS headers for the API endpoint at `https://example.com/api`"
+
+The skill will:
+1. Fetch the CORS headers from the specified API endpoint.
+2. Use the cors-policy-validator plugin to analyze the headers.
+3. Output a report summarizing the CORS configuration and any potential issues.
+
+## Best Practices
+
+- **Configuration Source**: Always specify the source of the CORS configuration (e.g., file path, URL) for accurate validation.
+- **Regular Validation**: Regularly validate CORS policies, especially after making changes to the application or API.
+- **Heuristic Analysis**: Consider supplementing validation with manual review and heuristic analysis to catch subtle vulnerabilities.
+
+## Integration
+
+This skill can be integrated with other security-related plugins to provide a more comprehensive security assessment. For example, it can be used in conjunction with vulnerability scanning tools to identify potential cross-site scripting (XSS) vulnerabilities related to CORS misconfigurations.

skills/cors-policy-validator/assets/README.md

@@ -0,0 +1,6 @@
+# Assets
+
+Bundled resources for cors-policy-validator skill
+
+- [ ] cors_policy_template.json: A JSON template for creating CORS policies, with placeholders for key configuration parameters.
+- [ ] test_report_template.html: An HTML template for displaying the results of CORS policy validation tests in a user-friendly format.

skills/cors-policy-validator/references/README.md

@@ -0,0 +1,7 @@
+# References
+
+Bundled resources for cors-policy-validator skill
+
+- [ ] cors_specification.md: A detailed markdown document containing the official CORS specification, including definitions of key terms, security considerations, and implementation guidelines.
+- [ ] common_cors_vulnerabilities.md: A markdown document outlining common CORS vulnerabilities, such as misconfigured origin patterns, wildcard usage, and improper header handling, with real-world examples and mitigation strategies.
+- [ ] example_cors_policies.md: A collection of example CORS policies for various use cases, including single-origin, multi-origin, and credentialed requests.

skills/cors-policy-validator/scripts/README.md

@@ -0,0 +1,6 @@
+# Scripts
+
+Bundled resources for cors-policy-validator skill
+
+- [ ] validate_cors.py: A Python script that takes a CORS policy configuration as input and performs detailed validation checks, including origin matching, header validation, and method verification. Returns a JSON report of findings.
+- [ ] generate_test_cases.py: A script to automatically generate test cases for different CORS configurations, ensuring comprehensive coverage of potential vulnerabilities.